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Quantum algorithms: an overview 

Ashley Montanaro 1 


Quantum computers are designed to outperform standard computers by running quantum algorithms. Areas in which quantum 
algorithms can be applied include cryptography, search and optimisation, simulation of quantum systems and solving large 
systems of linear equations. Here we briefly survey some known quantum algorithms, with an emphasis on a broad overview of 
their applications rather than their technical details. We include a discussion of recent developments and near-term applications of 
quantum algorithms. 
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INTRODUCTION 

A quantum computer is a machine designed to use quantum 
mechanics to do things which cannot be done by any machine 
based only on the laws of classical physics. Eventual applications 
of quantum computing range from breaking cryptographic 
systems to the design of new medicines. These applications 
are based on quantum algorithms—algorithms that run on a 
quantum computer and achieve a speedup, or other efficiency 
improvement, over any possible classical algorithm. Although 
large-scale general-purpose quantum computers do not yet exist, 
the theory of quantum algorithms has been an active area 
of study for over 20 years. Here we aim to give a broad overview 
of quantum algorithmics, focusing on algorithms with clear 
applications and rigorous performance bounds, and including 
recent progress in the field. 

Contrary to a rather widespread popular belief that quantum 
computers have few applications, the field of quantum algorithms 
has developed into an area of study large enough that a 
brief survey such as this cannot hope to be remotely 
comprehensive. Indeed, at the time of writing the 'Quantum 
Algorithm Zoo' website cites 262 papers on quantum algorithms. 1 
There are now a number of excellent surveys about quantum 
algorithms, 2-5 and we defer to these for details of the algorithms 
we cover here, and many more. In particular, we omit all 
discussion of how the quantum algorithms mentioned work. 
We will also not cover the important topics of how to actually 
build a quantum computer 6 (in theory or in practice) and quantum 
error-correction, 7 nor quantum communication complexity 8 or 
quantum Shannon theory. 9 

Measuring quantum speedup 

What does it mean to say that a quantum computer solves a 
problem more quickly than a classical computer? As is typical in 
computational complexity theory, we will generally consider 
asymptotic scaling of complexity measures such as runtime or 
space usage with problem size, rather than individual problems of 
a fixed size. In both the classical and quantum settings, we 
measure runtime by the number of elementary operations used 
by an algorithm. In the case of quantum computation, this can be 
measured using the quantum circuit model, where a quantum 


circuit is a sequence of elementary quantum operations called 
quantum gates, each applied to a small number of qubits 
(quantum bits). To compare the performance of algorithms, we 
use computer science style notation 0(f(n)), which should be 
interpreted as 'asymptotically upper-bounded by f(n)'. 

We sometimes use basic ideas from computational complexity 
theory, 10 and in particular the notion of complexity classes, which 
are groupings of problems by difficulty. See Table 1 for informal 
descriptions of some important complexity classes. If a problem is 
said to be complete for a complexity class, then this means that it 
is one of the 'hardest' problems within that class: it is contained 
within that class, and every other problem within that class 
reduces to it. 


THE HIDDEN SUBGROUP PROBLEM AND APPLICATIONS TO 
CRYPTOGRAPHY 

One of the first applications of quantum computers discovered 
was Shor's algorithm for integer factorisation. 11 In the factorisation 
problem, given an integer N = pxq for some prime numbers p 
and q, our task is to determine p and q. The best classical 
algorithm known (the general number field sieve) runs in time 
exp(0(log A/) 1/3 (log log A/) 273 )) 12 (in fact, this is a heuristic bound; 
the best rigorous bound is somewhat higher), while Shor's 
quantum algorithm solves this problem substantially faster, in 
time 0(log A/) 3 ). This result might appear only of mathematical 
interest, were it not for the fact that the widely used RSA 
public-key cryptosystem 13 relies on the hardness of integer 
factorisation. Shor's efficient factorisation algorithm implies that 
this cryptosystem is insecure against attack by a large quantum 
computer. 

As a more specific comparison than the above asymptotic 
runtimes, in 2010 Kleinjung et al . 14 reported classical factorisation 
of a 768-bit number, using hundreds of modern computers over a 
period of 2 years, with a total computational effort of ~10 20 
operations. A detailed analysis of one fault-tolerant quantum 
computing architecture, 7 making reasonable assumptions about 
the underlying hardware, suggests that a 2,000-bit number could 
be factorised by a quantum computer using -3X10 11 quantum 
gates, and approximately a billion qubits, running for just over a 
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Table 1 . Some computational complexity classes of importance in quantum computation 

Class 

Informal definition 

P 

Can be solved by a deterministic classical computer in polynomial time 

BPP 

Can be solved by a probabilistic classical computer in polynomial time 

BQP 

Can be solved by a quantum computer in polynomial time 

NP 

Solution can be checked by a deterministic classical computer in polynomial time 

QMA 

Solution can be checked by a quantum computer in polynomial time 

Abbreviation: QMA, Quantum Merlin-Arthur. 
'Polynomial time' is short for 'in time polynomial 

in the input size' 


day at a clock rate of 10 MHz. This is clearly beyond current 
technology, but does not seem unrealistic as a long-term goal. 

Shor's approach to integer factorisation is based on reducing 
the task to a special case of a mathematical problem known as the 
hidden subgroup problem (HSP), ' then giving an efficient 
quantum algorithm for this problem. The HSP is parametrised by a 
group G, and Shor's algorithm solves the case G=Z. Efficient 
solutions to the HSP for other groups G turn out to imply efficient 
algorithms to break other cryptosystems; we summarise some 
important cases of the HSP and some of their corresponding 
cryptosystems in Table 2. Two particularly interesting cases of the 
HSP for which polynomial-time quantum algorithms are not 
currently known are the dihedral and symmetric groups. A 
polynomial-time quantum algorithm for the former case would 
give an efficient algorithm for finding shortest vectors in lattices; 17 
an efficient quantum algorithm for the latter case would give an 
efficient test for isomorphism of graphs (equivalence under 
relabelling of vertices). 

SEARCH AND OPTIMISATION 

One of the most basic problems in computer science is 
unstructured search. This problem can be formalised as follows: 


Unstructured search problem: Given the ability to evaluate a 
function f:{ 0, 1} n -»{0, 1}, find x such that f{x) = 1, if such an x exists; 
otherwise, output 'not found'. 


It is easy to see that, with no prior information about f, any 
classical algorithm, which solves the unstructured search problem 
with certainty must evaluate f N = 2 n times in the worst case. Even 
if we seek a randomised algorithm which succeeds, say, with 
probability 1/2 in the worst case, then the number of evaluations 
required is of order N. However, remarkably, there is a quantum 
algorithm due to Grover, 18 which solves this problem using 
0(Vn) evaluations of f in the worst case (Grover's original 
algorithm solved the special case where the solution is unique; the 
extension to multiple solutions came slightly later. 19 ). The 
algorithm is bounded error; that is, it fails with probability e, for 
arbitrarily small (but fixed) e>0. Although fmay have some kind 
of internal structure, Grover's algorithm does not use this at all; we 
say that f is used as an oracle or black box in the algorithm. 

Grover's algorithm can immediately be applied to any problem 
in the complexity class NP. This class encapsulates decision 
problems whose solutions can be checked efficiently, in the 
following sense: there exists an efficient classical checking 
algorithm A such that, for any instance of the problem where 
the answer should be 'yes', there is a certificate that can be input 
to A such that A accepts the certificate. In other words, a 
certificate is a proof that the answer is 'yes', which can be checked 
by A. On the other hand, for any instance where the answer 
should be 'no', there should be no certificate that can make A 


accept it. The class NP encompasses many important problems 
involving optimisation and constraint satisfaction. 

Given a problem in NP that has a certificate of length m, by 
applying Grover's algorithm to A and searching over all possible 
certificates, we obtain an algorithm which uses time 0(2 m/2 poly 
(m)), rather than the 0(2 m poly(m)) used by classical exhaustive 
search over all certificates. This (nearly) quadratic speedup is less 
marked than the super-polynomial speedup achieved by Shor's 
algorithm, but can still be rather substantial. Indeed, if the 
quantum computer runs at approximately the same clock speed 
as the classical computer, then this implies that problem instances 
of approximately twice the size can be solved in a comparable 
amount of time. 

As a prototypical example of this, consider the fundamental 
NP-complete circuit satisfiability problem (Circuit SAT), which is 
illustrated in Figure 1. An instance of this problem is a description 
of an electronic circuit comprising AND, OR and NOT gates which 
takes n bits as input and produces 1 bit of output. The task is to 
determine whether there exists an input to the circuit such that 
the output is 1. Algorithms for Circuit SAT can be used to solve a 
plethora of problems related to electronic circuits; examples 
include design automation, circuit equivalence and model 
checking. 20 The best classical algorithms known for Circuit SAT 
run in worst-case time of order 2 n for n input variables, i.e., not 
significantly faster than exhaustive search. 21 By applying Grover's 
algorithm to the function f(x) which evaluates the circuit on input 
xe{0, 1} n , we immediately obtain a runtime of 0(2 n/2 poly(n)), 
where the poly(n) comes from the time taken to evaluate the 
circuit on a given input. 

Amplitude amplification 

Grover's algorithm speeds up the naive classical algorithm for 
unstructured search. Quantum algorithms can also accelerate 
more complicated classical algorithms. 


Heuristic search problem: Given the ability to execute a probabilistic 
'guessing' algorithm A, and a 'checking' function f, such that 
Pr[^4. outputs w such that f(w) = 1] =£, 
output w such that f{w) = 1. 


One way to solve the heuristic search problem classically is 
simply to repeatedly run A and check the output each time using 
f, which would result in an average of 0(1 /e) evaluations of f. 
However, a quantum algorithm due to Brassard, Hoyer, Mosca and 
Tapp 22 can find w such that f(w) = 1 with only 0(1 /y/e) uses of f, 
and failure probability arbitrarily close to 0, thus achieving a 
quadratic speedup. This algorithm is known as amplitude 
amplification, by analogy with classical probability amplification. 

The unstructured search problem discussed above fits into this 
framework, by simply taking A to be the algorithm, which outputs 
a uniformly random n-bit string. Further, if there are k inputs 


npj Quantum Information (2016) 15023 


© 2016 University of New South Wales/Macmillan Publishers Limited 









Quantum algorithms 
A Montanaro 


Table 2. Some problems which can be expressed as hidden subgroup problems 



Problem 

Group 

Complexity 

Cryptosystem 

Factorisation 

Z 

Polynomial 

RSA 

Discrete log 

Z p -i x Zp_ -| 

Polynomial 11 

Diffie-Hellman, DSA,... 

Elliptic curve discrete log 

Elliptic curve 

Polynomial 92 

ECDH, ECDSA,... 

Principal ideal 

R 

Polynomial 93 

Buchmann-Williams 

Shortest lattice vector 

Dihedral group 

Subexponential 94 ' 95 

NTRU, Ajtai-Dwork,... 

Graph isomorphism 

Symmetric group 

Exponential 

— 

The table lists the time complexity of the best quantum algorithms known for the HSPs and the cryptosystems that are (or would be) broken by polynomial¬ 
time algorithms. 



3 



Figure 1. An instance of the Circuit SAT problem. The answer should 
be 'yes' as there exists an input to the circuit such that the 
output is 1. 


w E {0, 1} n such that f(w) = 1, then 

Px[A outputs w such that f(w) = 1] = —, 

so we can find a w such that f(w) = 1 with 0(^/N/k) queries to 
f. However, we could imagine A being a more complicated 
algorithm or heuristic targeted at a particular problem we would 
like to solve. For example, one of the most efficient classical 
algorithms known for the fundamental NP-complete constraint 
satisfaction problem 3-SAT is randomised and runs in time 
0((4/3) n poly(n)) 23 Amplitude amplification can be applied to this 
algorithm to obtain a quantum algorithm with runtime 
0((4/3) n/2 poly(n)), illustrating that quantum computers can 
speedup non-trivial classical algorithms for NP-complete problems. 

An interesting future direction for quantum algorithms is finding 
accurate approximate solutions to optimisation problems. Recent 
work of Farhi, Goldstone and Gutmann 24 gave the first quantum 
algorithm for a combinatorial task (simultaneously satisfying many 
linear equations of a certain form) which outperformed the best 
efficient classical algorithm known in terms of accuracy; in this 
case, measured by the fraction of equations satisfied. This inspired 
a more efficient classical algorithm for the same problem, 25 leaving 
the question open of whether quantum algorithms for optimisa¬ 
tion problems can substantially outperform the accuracy of their 
classical counterparts. 

Applications of Grover's algorithm and amplitude amplification 

Grover's algorithm and amplitude amplification are powerful 
subroutines, which can be used as part of more complicated 
quantum algorithms, allowing quantum speedups to be obtained 
for many other problems. We list just a few of these speedups here. 

1. Finding the minimum of an unsorted list of N integers 
(equivalently, finding the minimum of an arbitrary and initially 
unknown function f:{ 0,1} n ->Z). A quantum algorithm due to 
Durr and Hoyer 26 solves this problem with 0(y/N) evaluations 
of f, giving a quadratic speedup over classical algorithms. Their 
algorithm is based on applying Grover's algorithm to a function 
g:{ 0, 1} n ^{0, 1} defined by g(x) = 1, if and only if f(x)<T for 
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some threshold T. This threshold is initially random, and then 
updated as inputs x are found such that f{x) is below the 
threshold. 

2. Determining graph connectivity. To determine whether a graph 
on N vertices is connected requires time of order N 2 classically 
in the worst case. Durr, Heiligman, Hoyer and Mhalla 27 give a 
quantum algorithm which solves this problem in time 0(A/ 372 ), 
up to logarithmic factors, as well as efficient algorithms for 
some other graph-theoretic problems (strong connectivity, 
minimum spanning tree, shortest paths). 

3. Pattern matching, a fundamental problem in text processing 
and bioinformatics. Here the task is to find a given pattern P of 
length M within a text T of length N, where the pattern and the 
text are strings over some alphabet. Ramesh and Vinay have 
given a quantum algorithm 28 which solves this problem in time 

0(VN + y/M), up to logarithmic factors, as compared with the 
best possible classical complexity 0(N+M). These are both 
worst-case time bounds, but one could also consider an 
average-case setting where the text and pattern are both 
picked at random. Here the quantum speedup is more 
pronounced: there is a quantum algorithm which combines 
amplitude amplification with ideas from the dihedral hidden 

subgroup problem and runs in time 0(yjN /M2 0( V logM )) up to 
logarithmic factors, as compared with the best possible 
classical runtime 0(N/M + \//V). 29 This is a super-polynomial 
speedup when M is large. 


Adiabatic optimisation 

An alternative approach to quantum combinatorial optimisation is 
provided by the quantum adiabatic algorithm. 30 The adiabatic 
algorithm can be applied to any constraint satisfaction problem 
(CSP) where we are given a sequence of constraints applied to 
some input bits, and are asked to output an assignment to the 
input bits, which maximises the number of satisfied constraints. 
Many such problems are NP-complete and of significant practical 
interest. The basic idea behind the algorithm is physically 
motivated, and based around a correspondence between CSPs 
and physical systems. We start with a quantum state that is the 
uniform superposition over all possible solutions to the CSP. This is 
the ground (lowest energy) state of a Hamiltonian that can be 
prepared easily. This Hamiltonian is then gradually modified to 
give a new Hamiltonian whose ground state encodes the solution 
maximising the number of satisfied constraints. The quantum 
adiabatic theorem guarantees that if this process is carried out 
slowly enough, the system will remain in its ground-state 
throughout; in particular, the final state gives an optimal solution 
to the CSP. The key phrase here is 'slowly enough'; for some 
instances of CSPs on n bits, the time required for this evolution 
might be exponential in n. 

Unlike the algorithms described in the rest of this survey, the 
adiabatic algorithm lacks general, rigorous worst-case upper 
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bounds on its runtime. Although numerical experiments can be 
carried out to evaluate its performance on small instances, 31 this 
rapidly becomes infeasible for larger problems. One can construct 
problem instances on which the standard adiabatic algorithm 
provably takes exponential time; 32,33 however, changing the 
algorithm can evade some of these arguments. 34,35 

The adiabatic algorithm can be implemented on a universal 
quantum computer. However, it also lends itself to direct 
implementation on a physical system whose Hamiltonian can be 
varied smoothly between the desired initial and final 
Hamiltonians. The most prominent exponent of this approach is 
the company D-Wave Systems, which has built large machines 
designed to implement this algorithm, 36 with the most 
recent such machine ('D-Wave 2X') announced as having up to 
1,152 qubits. For certain instances of CSPs, these machines 
have been demonstrated to outperform classical solvers 
running on a standard computer, 37,38 although the speedup 
(or otherwise) seems to have a rather subtle dependence on the 
problem instance, classical solver compared, and measure of 

38 39 

comparison. 

As well as the theoretical challenges to the adiabatic algorithm 
mentioned above, there are also some significant practical 
challenges faced by the D-Wave system. In particular, these 
machines do not remain in their ground state throughout, but are 
in a thermal state above absolute zero. Because of this, the 
algorithm actually performed has some similarities to classical 
simulated annealing, and is hence known as 'quantum annealing'. 
It is unclear at present whether a quantum speedup predicted for 
the adiabatic algorithm would persist in this setting. 

QUANTUM SIMULATION 

In the early days of classical computing, one of the main 
applications of computer technology was the simulation of 
physical systems (such applications arguably go back at least as 
far as the Antikythera mechanism from the 2nd century BC.). 
Similarly, the most important early application of quantum 
computers is likely to be the simulation of quantum 
systems. 40-42 Applications of quantum simulation include quan¬ 
tum chemistry, superconductivity, metamaterials and high-energy 
physics. Indeed, one might expect that quantum simulation would 
help us understand any system where quantum mechanics has 
a role. 

The word 'simulation' can be used to describe a number of 
problems, but in quantum computation is often used to mean the 
problem of calculating the dynamical properties of a system. This 
can be stated more specifically as: given a Hamiltonian 
H describing a physical system, and a description of an 
initial state ip) of that system, output some property of the state 
\ip t ) = e~ lHt ip) corresponding to evolving the system according to 
that Hamiltonian for time t. As all quantum systems obey the 
Schrodinger equation, this is a fundamentally important task; 
however, the exponential complexity of completely describing 
general quantum states suggests that it should be impossible to 


achieve efficiently classically, and indeed no efficient general 
classical algorithm for quantum simulation is known. This problem 
originally motivated Feynman to ask whether a quantum 
computer could efficiently simulate quantum mechanics. 43 

A general-purpose quantum computer can indeed efficiently 
simulate quantum mechanics in this sense for many physically 
realistic cases, such as systems with locality restrictions on their 
interactions. 44 Given a description of a quantum state | ip), a 
description of H, and a time t, the quantum simulation algorithm 
produces an approximation to the state \ip t ). Measurements can 
then be performed on this state to determine quantities of 
interest about it. The algorithm runs in time polynomial in the size 
of the system being simulated (the number of qubits) and 
the desired evolution time, giving an exponential speedup over 
the best general classical algorithms known. However, there is still 
room for improvement and quantum simulation remains a topic 
of active research. Examples include work on increasing the 
accuracy of quantum simulation while retaining a fast runtime; 45 
optimising the algorithm for particular applications such as 
quantum chemistry; 46 and exploring applications to new areas 
such as quantum field theory. 47 

The above, very general, approach is sometimes termed digital 
quantum simulation: we assume we have a large-scale, general- 
purpose quantum computer and run the quantum simulation 
algorithm on it. By contrast, in analogue quantum simulation we 
mimic one physical system directly using another. That is, if we 
would like to simulate a system with some Hamiltonian H, then we 
build another system that can be described by a Hamiltonian 
approximating H. We have gained something by doing this if the 
second system is easier to build, to run or to extract information 
from than the first. For certain systems analogue quantum 
simulation may be significantly easier to implement than digital 
quantum simulation, at the expense of being less flexible. It is 
therefore expected that analogue simulators outperforming their 
classical counterparts will be implemented first. 40 

QUANTUM WALKS 

In classical computer science the concept of the random walk or 
Markov chain is a powerful algorithmic tool, and is often applied 
to search and sampling problems. Quantum walks provide a 
similarly powerful and general framework for designing fast 
quantum algorithms. Just as a random walk algorithm is based on 
the simulated motion of a particle moving randomly within some 
underlying graph structure, a quantum walk is based on the 
simulated coherent quantum evolution of a particle moving on 
a graph. 

Quantum walk algorithms generally take advantage of one of 
two ways in which quantum walks outperform random walks: 
faster hitting (the time taken to find a target vertex from a source 
vertex), and faster mixing (the time taken to spread out over all 
vertices after starting from one source vertex). For some graphs, 
hitting time of quantum walks can be exponentially less than their 
classical counterparts. 48,49 The separation between quantum and 



Figure 2. Three graphs for whose natural generalisations to N vertices a classical random walk requires exponentially more time than a 
quantum walk to reach the exit (B) from the entrance (A). However, on the first two graphs there exist efficient classical algorithms to find the 
exit which are not based on a random walk. 
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classical mixing time can be quadratic, but no more than this 50 
(approximately). Nevertheless, fast mixing has proven to be a very 
useful tool for obtaining general speedups over classical 
algorithms. 

Figure 2 illustrates special cases of three families of graphs for 
which quantum walks display faster hitting than random walks: 
the hypercube, the 'glued trees' graph, and the 'glued trees' graph 
with a random cycle added in the middle. This third example is of 
particular interest because quantum walks can be shown to 
outperform any classical algorithm for navigating the graph, even 
one not based on a random walk. A continuous-time quantum 
walk that starts at the entrance (on the left-hand side) and runs for 
time 0(log N) finds the exit (on the right-hand side) with 
probability at least 1/poly(log A/). However, any classical algorithm 
requires time of order N ve> to find the exit. 51 Intuitively, the 
classical algorithm can progress quickly at first, but then gets 
'stuck' in the random part in the middle of the graph. The 
coherence and symmetry of the quantum walk make it essentially 
blind to this randomness, and it efficiently progresses from the left 
to the right. 

A possibly surprising application of quantum walks is fast 
evaluation of boolean formulae. A boolean formula on N binary 
inputs x v ...,x N is a tree whose internal vertices represent AND (A), 
OR (V) or NOT H gates applied to their child vertices, and whose 
N leaves are labelled with the bits x^,...,x N . Two such formulae are 
illustrated in Figure 3. There is a quantum algorithm which allows 
any such formula to be evaluated in slightly more than 0(A/ 1/2 ) 
operations, 52 while it is known that for a wide class of boolean 
formulae, any randomised classical algorithm requires time of 
order a/ 0 753 " in the worst case. 53 The quantum algorithm is based 
around the use and analysis of a quantum walk on the tree graph 
corresponding to the formula's structure. A particularly interesting 
special case of the formula evaluation problem which displays a 
quantum speedup is evaluating AND-OR trees, which corresponds 
to deciding the winner of certain two-player games. 

Quantum walks can also be used to obtain a very general 
speedup over classical algorithms based on Markov chains. A 
discrete-time Markov chain is a stochastic linear map defined in 
terms of its transition matrix P, where P xy is the probability of 
transitioning from state x to state y. Many classical search 
algorithms can be expressed as simulating a Markov chain for a 
certain number of steps, and checking whether a transition is 
made to a 'marked' element for which we are searching. A key 
parameter that determines the efficiency of this classical algorithm 
is the spectral gap 6 of the Markov chain (i.e., the difference 
between the largest and second-largest eigenvalues of P). 

There are analogous algorithms based on quantum walks, 
which improve the dependence on 6 quadratically, from 1/6 to 
1 /\/6. 54-56 This framework has been used to obtain quantum 
speedups for a variety of problems, 4 ranging from determining 
whether a list of integers are all distinct 54 to finding triangles in 
graphs. 57 

SOLVING LINEAR EQUATIONS AND RELATED TASKS 

A fundamental task in mathematics, engineering and many areas 
of science is solving systems of linear equations. We are given an 


X\ X2 X3 X4 X\ X2 X3 X4 

Figure 3. Two boolean formulae on 4 bits. For Xt = 1, x 2 = x 3 =x 4 = 0, 
for example, the first formula evaluates to 1 and the second to 0. The 
second formula is an AND-OR tree. 
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NxN matrix A, and a vector be R N , and are asked to output x 
such that Ax= b. This problem can be solved in time polynomial in 
N by straightfoward linear-algebra methods such as Gaussian 
elimination. Can we do better than this? This appears difficult, 
because even to write down the answer x would require time of 
order N. The quantum algorithm of Harrow, Hassidim and Lloyd 58 
(HHL) for solving systems of linear equations sidesteps this issue 
by 'solving' the equations in a peculiarly quantum sense: given the 
ability to create the quantum state | b) = b/|/), and access to 

A, the algorithm outputs a state approximately proportional to 
|x) = £ /= i X/|/>. This is an A/-dimensional quantum state, which 
can be stored in 0(log N) qubits. 

The algorithm runs efficiently, assuming that the matrix A 
satisfies some constraints. First, it should be sparse—each row 
should contain at most d elements, for some d <^N. We should be 
given access to A via an function to which we can pass a row 
number r and an index /, with 1 </< d, and which returns the /'th 
nonzero element in the r'th row. Also, the condition number 
k = HA -1 IIIIAII, a parameter measuring the numerical instability of 
A, should be small. Assuming these constraints, |x) can be 
approximately produced in time polynomial in log N, d and x. 58,59 
If d and k are small, then this is an exponential improvement on 
standard classical algorithms. Indeed, one can even show that 
achieving a similar runtime classically would imply that classical 
computers could efficiently simulate any polynomial-time 
quantum computation. 58 

Of course, rather than giving as output the entirety of x, the 
algorithm produces an A/-dimensional quantum state |x); to 
output the solution x itself would then involve making many 
measurements to completely characterise the state, requiring time 
of order N in general. However, we may not be interested in the 
entirety of the solution, but rather in some global property of it. 
Such properties can be determined by performing measurements 
on |x). For example, the HHL algorithm allows one to efficiently 
determine whether two sets of linear equations have the same 
solution, 59 as well as many other simple global properties. 60 

The HHL algorithm is likely to find applications in settings where 
the matrix A and the vector b are generated algorithmically, rather 
than being written down explicitly. One such setting is the finite 
element method (FEM) in engineering. Recent work by Clader, 
Jacobs and Sprouse has shown that the HHL algorithm, when 
combined with a preconditioner, can be used to solve an 
electromagnetic scattering problem via the FEM. 60 The same 
algorithm, or closely related ideas, can also be applied to 
problems beyond linear equations themselves. These include 
solving large systems of differential equations, 61,62 data fitting 63 
and various tasks in machine learning. 64 It should be stressed 
that in all these cases the quantum algorithm 'solves' these 
problems in the same sense as the HHL algorithm solves them: it 
starts with a quantum state and produces a quantum state as 
output. Whether this is a reasonable definition of 'solution' 
depends on the application, and again may depend on whether 
the input is produced algorithmically or is provided explicitly as 
arbitrary data. 65 

FEW-QUBIT APPLICATIONS AND EXPERIMENTAL 
IMPLEMENTATIONS 

Although progress in experimental quantum computation has 
been rapid, there is still some way to go before we have a 
large-scale, general-purpose quantum computer, with current 
implementations consisting of only a few qubits. Any quantum 
computation operating on at most 20-30 qubits in the standard 
quantum circuit model can be readily simulated on a modern 
classical computer. Therefore, existing implementations of 
quantum algorithms should usually be seen as proofs of principle 
rather than demonstrating genuine speedups over the classical 
state of the art. In Table 3 we highlight some experimental 
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Table 3. Some proof-of-concept experimental implementations of quantum algorithms 


Algorithm 

Technology 

Problem solved 

Shor's algorithm 

Bulk optics 96 

Factorisation of 21 

Grover's algorithm 

NMR 97 

Unstructured search, N=8 

Quantum annealing 

D-Wave 2X 38 

Ising model on a 'Chimera' graph with 1097 vertices 

HHL algorithm 

Bulk optics, 98 ' 99 NMR' 00 

2x2 system of linear equations 

Abbreviations: HHL, Harrow, Hassidim and Lloyd; NMR, nuclear magnetic resonance. 

Table only includes some 'largest' problem instances solved thus far. 
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implementations of algorithms discussed here, focusing on the 
largest problem sizes considered thus far (although note that one 
has to be careful when using 'problem size' as a proxy for 
'difficulty in solving on a quantum computer'. 66 ). 

An important algorithm omitted from this table is quantum 
simulation. This topic has been studied since the early days of 
quantum computation (with perhaps the first implementation 
dating from 1999 67 , and quantum simulations have now been 
implemented, in some form, on essentially every technological 
platform for quantum computing. One salient example is the use 
of a 6-qubit ion trap system 68 to implement general digital 
quantum simulation; we defer to survey papers 40,42,69,70 for many 
further references. It is arguable that quantum simulations, in the 
sense of measuring the properties of a controllable quantum 
system, have already been performed that are beyond the reach 
of current classical simulation techniques. 71 

One application of digital quantum simulation which is 
currently the object of intensive study is quantum 
chemistry. 46,72,73 Classical techniques for molecular simulation 
are currently limited to molecules with 50-70 spin orbitals. 72 As 
each spin orbital corresponds to a qubit in the quantum 
simulation algorithm, a quantum computer with as few as 100 
logical qubits could perform calculations beyond the reach of 
classical computation. The challenge in this context is optimising 
the simulation time; although polynomial in the number of 
orbitals, this initially seemed prohibitively long, 73 but was rapidly 
improved via detailed analysis. 72 

The demonstration of quantum algorithms which outperform 
classical computation in the more immediate future is naturally of 
considerable interest. The Boson Sampling problem was designed 
specifically to address this. 74 Boson Sampling is the problem of 
sampling from the probability distribution obtained by feeding n 
photons through a linear-optical network on m modes, where 
m » n. This task is conjectured to be hard for a classical computer 
to solve. 74 However, Boson Sampling can be performed easily 
using linear optics, and indeed several small-scale experimental 
demonstrations with a few photons have already been carried 
out. 75 Although Boson Sampling was not originally designed with 
practical applications in mind, subsequent work has explored 
connections to molecular vibrations and vibronic spectra. 76,77 

One way in which quantum algorithms can be profitably 
applied for even very small-scale systems is 'quantum algorithmic 
thinking': applying ideas from the design of quantum algorithms 
to physical problems. An example of this from the field of 
quantum metrology is the development of high-precision 
quantum measurement schemes based on quantum phase 
estimation algorithms. 78 

ZERO-QUBIT APPLICATIONS 

We finally mention some ways in which quantum computing is 
useful now, without the need for an actual large-scale quantum 
computer. These can be summarised as the application of ideas 
from the theory of quantum computation to other scientific and 
mathematical fields. 
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First, the field of Hamiltonian complexity aims to characterise 
the complexity of computing quantities of interest about 
quantum-mechanical systems. A prototypical example, and a 
fundamental task in quantum chemistry and condensed-matter 
physics, is the problem of approximately calculating the ground- 
state energy of a physical system described by a local Hamiltonian. 
It is now known that this problem—along with many others—is 
Quantum Merlin-Arthur (QMA)-complete. 79,80 Problems in the 
class QMA are those which can be efficiently solved by a quantum 
computer given access to a quantum 'certificate'. We imagine that 
the certificate is produced by an all-powerful (yet untrustworthy) 
wizard Merlin, and given to a polynomial-time human Arthur to 
check; hence Quantum Merlin-Arthur. Classically, if a problem is 
proven NP-complete, then this is considered as good evidence 
that there is no efficient algorithm to solve it. Similarly, 
QMA-complete problems are considered unlikely to have efficient 
quantum (or classical) algorithms. One can even go further than 
this, and attempt to characterise for which families of physical 
systems calculating ground-state energies is hard, and for which 
the problem is easy. 29,81 Although this programme is not yet 
complete, it has already provided some formal justification for 
empirical observations in condensed-matter physics about relative 
hardness of these problems. 

Second, using the model of quantum information as a 
mathematical tool can provide insight into other problems of 
a purely classical nature. For example, a strong lower bound on 
the classical communication complexity of the inner product 
function can be obtained based on quantum information- 
theoretic principles. 82 Ideas from quantum computing have also 
been used to prove new limitations on classical data structures, 
codes and formulae. 83 

OUTLOOK 

We have described a rather large number of quantum algorithms, 
solving a rather large number of problems. However, one might 
still ask why more algorithms are not known—and in particular, 
more exponential speedups? 

One reason is that strong lower bounds have been proven on the 
power of quantum computation in the query complexity model, 
where one considers only the number of queries to the input as 
the measure of complexity. For example, the complexity achieved 
by Grover's algorithm cannot be improved by even one 
query while maintaining the same success probability 84 More 
generally, in order to achieve an exponential speedup over classical 
computation in the query complexity model there has to be a 
promise on the input, i.e., some possible inputs must be 
disallowed 85 This is one reason behind the success of quantum 
algorithms in cryptography: the existence of hidden problem 
structure that quantum computers can exploit in ways that classical 
computers cannot. Finding such hidden structure in other problems 
of practical interest remains an important open problem. 

In addition, a cynical reader might point out that known 
quantum algorithms are mostly based on a rather small number of 
quantum primitives (such as the quantum Fourier transform and 
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quantum walks). An observation attributed to van Dam (see 
http://dabacon.org/pontiff/7p = 1291) provides some justification 
for this. It is known that any quantum circuit can be approximated 
using only Toffoli and Hadamard quantum gates. 86 The first of 
these is a purely classical gate, and the second is equivalent to the 
Fourier transform over the group Z 2 . Thus any quantum algorithm 
whatsoever can be expressed as the use of quantum Fourier 
transforms interspersed with classical processing! Flowever, the 
intuition behind the quantum algorithms described above is much 
more varied than this observation would suggest. The inspiration 
for other quantum algorithms, not discussed here, includes 
topological quantum field theory; 87 connections between 
quantum circuits and spin models; 88 the Elitzur-Vaidman 
quantum bomb tester; 89 and directly solving the semidefinite 
programming problem characterising quantum query 
complexity. 90,91 

As well as the development of new quantum algorithms, an 
important direction for future research seems to be the 
application of known quantum algorithms (and algorithmic 
primitives) to new problem areas. This is likely to require 
significant input from, and communication with, practitioners in 
other fields. 
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